1 /* $OpenBSD: auth-chall.c,v 1.12 2006/08/03 03:34:41 deraadt Exp $ */ 2 /* 3 * Copyright (c) 2001 Markus Friedl. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 24 */ 25 26 #include "includes.h" 27 28 #include <sys/types.h> 29 30 #include <stdarg.h> 31 32 #include "xmalloc.h" 33 #include "key.h" 34 #include "hostfile.h" 35 #include "auth.h" 36 #include "log.h" 37 #include "servconf.h" 38 39 /* limited protocol v1 interface to kbd-interactive authentication */ 40 41 extern KbdintDevice *devices[]; 42 static KbdintDevice *device; 43 extern ServerOptions options; 44 45 char * 46 get_challenge(Authctxt *authctxt) 47 { 48 char *challenge, *name, *info, **prompts; 49 u_int i, numprompts; 50 u_int *echo_on; 51 52 #ifdef USE_PAM 53 if (!options.use_pam) 54 remove_kbdint_device("pam"); 55 #endif 56 57 device = devices[0]; /* we always use the 1st device for protocol 1 */ 58 if (device == NULL) 59 return NULL; 60 if ((authctxt->kbdintctxt = device->init_ctx(authctxt)) == NULL) 61 return NULL; 62 if (device->query(authctxt->kbdintctxt, &name, &info, 63 &numprompts, &prompts, &echo_on)) { 64 device->free_ctx(authctxt->kbdintctxt); 65 authctxt->kbdintctxt = NULL; 66 return NULL; 67 } 68 if (numprompts < 1) 69 fatal("get_challenge: numprompts < 1"); 70 challenge = xstrdup(prompts[0]); 71 for (i = 0; i < numprompts; i++) 72 xfree(prompts[i]); 73 xfree(prompts); 74 xfree(name); 75 xfree(echo_on); 76 xfree(info); 77 78 return (challenge); 79 } 80 int 81 verify_response(Authctxt *authctxt, const char *response) 82 { 83 char *resp[1], *name, *info, **prompts; 84 u_int i, numprompts, *echo_on; 85 int authenticated = 0; 86 87 if (device == NULL) 88 return 0; 89 if (authctxt->kbdintctxt == NULL) 90 return 0; 91 resp[0] = (char *)response; 92 switch (device->respond(authctxt->kbdintctxt, 1, resp)) { 93 case 0: /* Success */ 94 authenticated = 1; 95 break; 96 case 1: /* Postponed - retry with empty query for PAM */ 97 if ((device->query(authctxt->kbdintctxt, &name, &info, 98 &numprompts, &prompts, &echo_on)) != 0) 99 break; 100 if (numprompts == 0 && 101 device->respond(authctxt->kbdintctxt, 0, resp) == 0) 102 authenticated = 1; 103 104 for (i = 0; i < numprompts; i++) 105 xfree(prompts[i]); 106 xfree(prompts); 107 xfree(name); 108 xfree(echo_on); 109 xfree(info); 110 break; 111 } 112 device->free_ctx(authctxt->kbdintctxt); 113 authctxt->kbdintctxt = NULL; 114 return authenticated; 115 } 116 void 117 abandon_challenge_response(Authctxt *authctxt) 118 { 119 if (authctxt->kbdintctxt != NULL) { 120 device->free_ctx(authctxt->kbdintctxt); 121 authctxt->kbdintctxt = NULL; 122 } 123 } 124
